The present invention relates generally to vehicle safety systems and more particularly relates to a microprocessor system for safety-critical control operations.
Safety-critical control operations of this type include, among others, control systems which intervene into the braking function of an automotive vehicle. These control systems are marketed in large quantities and marketed under many different designs. Examples are anti-lock systems (ABS), traction slip control systems (TCS), driving stability control systems (DSC, ASMS), suspension control systems, etc. Failure of any such control system jeopardizes the driving stability of the vehicle. Therefore, operability of the systems is constantly monitored in order to deactivate the control when a malfunction occurs, or to switch it to a default mode which is less dangerous.
Matters are even more critical for brake systems or automotive vehicle control systems where a switch-over to a mechanical or hydraulic system is not possible upon failure of the electronics. Among those systems are brake system concepts such as xe2x80x98brake-by-wirexe2x80x99 which are likely to gain in significance in the future. The braking function in such systems strongly depends on an intact electronics.
German patent No. 32 34 637 discloses one example of a circuit configuration or a microprocessor system for controlling and monitoring an anti-lock vehicle brake system. In this patent, the input data are sent in parallel to two identically programmed microcomputers where they are processed synchronously. The output signals and intermediate signals of the two microcomputers are compared for correlation by way of redundant comparators. In the event of non-correlation of the signals, the control is disconnected by a circuit which also has a redundant design. In this prior art circuit, one of the two microcomputers is used to produce the braking pressure control signals and the other one is used to produce the test signals. Thus, two complete microcomputers, including the associated read-only and random-access memories are required in this symmetrically designed microprocessor system.
According to another prior art system, the way the circuit described in German patent application No. 41 37 124 is designed, the input data are also sent in parallel to two microcomputers, only one of which executes the complete sophisticated signal processing operation. The main purpose of the second microcomputer is for monitoring the input signals, and, after conditioning the input signals, for producing time derivatives, etc., that can be processed further by way of simplified control algorithms and a simplified control philosophy. The simplified data processing is sufficient to generate signals which indicate the proper operation of the system by comparison with the signals processed in the more sophisticated microcomputer. The use of a test microcomputer of lower capacity permits reducing the manufacturing effort compared to a system with two complete sophisticated microcomputers of the same capacity.
German patent application No. 43 41 082 discloses a microprocessor system which is provided especially for the control system of an anti-lock brake system. The system known from the art which can be incorporated on one single chip comprises two central units in which the input data are processed in parallel. The read-only and the random-access memories which are connected to the two central units have additional memory locations for test information, each comprising a generator to produce the test information. The output signals of one of the two central units are further processed to produce the control signals, while the other central unit, being a passive central unit, is only used to monitor the active central unit.
Thus, the necessary safety is principally achieved by redundance of the data processing in the above-mentioned prior art systems. In the first case of application (German patent No. 32 34 637), the system is based on using two processors with identical software which the experts call a symmetrical redundance. In the second case of application (German patent application No. 41 37 124), two processors with a different software are used (so-called unsymmetrical redundance). It is principally also possible to utilize one single processor which processes the input data on the basis of different algorithms, and additional testing algorithms are then applied for determining faultless operation.
Finally, a system of the above-mentioned type is known from German patent application No. 195 292 434 (P 7959) which could be interpreted as a system with core redundance. In this prior art microprocessor system, two synchronously operated central units are provided on one chip or on several chips which have the same input information and execute the same program. The two central units are connected to the read-only and the random-access memories by way of separate bus systems as well as to input and output units. The bus systems are interconnected by drivers or bypasses, respectively, which enable both central units to jointly read and execute the data available, including the test data and commands. The system renders it possible to economize memory locations. Only one of the two central units is connected (directly) to a complete read-only and random-access memory, while the memory capacity of the second processor is limited to memory locations for test data (parity monitoring) in connection with a test data generator. Access to all data is possible by way of the bypasses. This makes it possible for both central units to execute the complete program.
All above-mentioned systems are principally based on the comparison of redundantly processed data and the generation of an error signal when differences appear. The control can be deactivated upon the occurrence of an error or malfunction of a system. An emergency operation function, i.e., continuing the control after the occurrence of the error, is in no case possible. Basically, such an emergency operation function would be possible only by doubling the redundant systems in connection with an identification and elimination of the source of errors.
An object of the present invention is to configure a microprocessor system of the above-mentioned type with as little additional effort and cost so that an emergency operation function becomes possible upon the occurrence of an error without impairing safety.
The special features of this system include that there is provision of at least three central units with associated bus systems which are extended by redundant periphery units into at least two complete control signal circuits and are interconnected in such a manner that, upon failure of a central unit or an associated component, the faulty central unit is identified by a majority decision and an emergency operation function is ensured, and the output or generation of control signals as a function of the faulty central unit is prevented. During the emergency operation function, preferably, redundant data processing and comparison of the data processing results for correlation is maintained and non-correlation of the data processing results is signaled.
Thus, the present invention is founded upon the above-mentioned system known from German patent application No. 195 29 434 which is principally composed of one complete and one incomplete data processing system, and extends this system by an additional complete data processing system with the associated periphery units. The result is two complete control signal circuits or control signal processing systems which are interconnected to provide a total system that achieves an emergency operation function and ensures maintaining the control with redundant data processing and, hence, with the necessary high degree of safety even upon failure of a processor or a central unit. This means that the interconnection of the individual systems or components according to the present invention permits maintaining the redundance of the data processing even upon failure of a processor.
The total number of memory locations needed which generally determines the price of the microprocessor system is only increased by little more than 100%, compared to processing in a non-redundant system, and the distribution and allocation of the memory locations to the individual processors is variable within wide limits. It must only be ensured that each individual processor or each individual processor unit can execute the full program and, further, has access to the test data or redundance data. In comparison to a non-redundant system, a double memory capacity plus some memory locations for the redundance data is required.
The configuration of the microprocessor system according to the present invention permits accommodating all or the main components, especially all central units, memories, comparators and bypasses as well as, if necessary, the input and output units, on one single chip.
According to an embodiment of the present invention, there is provision of three central units with each one bus system, and at least the double number of memory locations, compared to the memory locations required for a non-redundant system, are available for the read-only and random-access memories. By way of the bypasses, all central units are connected to the memory locations in the write and read directions and to all input and output units.
The three central units, along with the memories, the input and output units and the periphery units, including the voltage supply, etc., form two complete and one incomplete data processing systems in total. The memory locations required for a complete program run are distributed among two data processing systems, however. Favorably, each of the data processing systems comprises at least one central unit and one bus system as well as read-only and random-access memories and/or redundance information memories, and the memory locations are distributed among the individual data processing systems so that, upon the occurrence of an error and change-over to the emergency operation function, the intact systems have a sufficient number of memory locations for the complete data processing and for redundance information, and execute the complete program.
In another aspect of the present invention, at least the central units with the bus systems, the memories, the bypass units, the input and output units and some or all comparators are located on one joint chip.